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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF IDAHO 



BATTELLE ENERGY ALLIANCE, 
LLC, a Delaware limited liability 
company, 

Plaintiff, 

vs. 

SOUTHFORK SECURITY, INC., an 
Idaho corporation, COREY THUEN, an 
individual, and DOES 1 through 10, 
inclusive, 

Defendants. 



INTRODUCTION 

Pending before the Court is plaintiff Battelle Energy Alliance, LLC's £jc Parte 
Application for a Temporary Restraining Order (Dkt. 2). Battelle asks for an order (1) 
requiring defendants to disable Southfork's website ( http://www.southforksecurity.com ) 
and take down all internet postings related to computer programs known as Visdom and 
Sophia (which are described further below), and (2) permitting Battelle and its computer 
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forensic expert to "image or copy" defendant Corey Thuen's "computer(s) hard drive(s) 
and the data thereon to hold in escrow for the purpose of preserving critical evidence." 
Ex Parte App., Dkt. 2, at 2. 

The Court will issue an order preventing defendants from releasing Sophia or 
Visdom as open-source products. The Court will also authorize Battelle's forensic expert 
to (1) make a single copy or image of defendant Thuen's computer hard drive, (2) 
without examining that copy or image in any manner, immediately deliver it to the Court 
where it will be held pending further litigation in this case; and (3) after the copy or 
image is made, return the computer to the defendant Thuen in the same condition it was 
in when received. Between the time this Order is issued and the time the copying takes 
place, the Court will order the defendant Thuen to preserve his hard drive by not deleting 
any material thereon. 

BACKGROUND 

The Idaho National Laboratory is a federal governmental facility owned by the 
United States Department of Energy. Plaintiff Battelle is the lab's management and 
operating contractor. Battelle's work at the lab includes performing federally funded 
research projects. 

In 2009, the Department of Energy commissioned Battelle to research and develop 
a computer program aimed at protecting the United States' critical energy infrastructure 
(oil, gas, chemical and electrical companies) from cyber attacks. Defendant Corey Thuen 
is a former Battelle employee who helped develop this computer program during his 
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tenure at Battelle. The program ultimately became known as Sophia. The name Sophia 
was chosen as a reference to the Greek goddess of wisdom. 

Battelle tested Sophia in 2012 and learned that electric utility companies were 
interested in a commercial version of the software program. These companies, however, 
said they did not want an "open source" version of the software, which means that the 
source code would be available to the public. Instead, they wanted a closed-loop 
proprietary version of the software. 

Battelle does not have the capability to commercialize its research products and 
inventions. Rather, the lab licenses its technologies to third parties who market and sell 
them. Thus, as Sophia neared completion, Battelle began a bidding process, which 
allowed commercial software and network security firms to compete for the right to 
exclusively license Sophia. Defendant Southfork Security, Inc. was one of eight 
companies who expressed an interest in competing for the exclusive license. Thuen 
created Southfork for the purpose of bidding on Sophia. 

Southfork submitted a licensing proposal for Sophia in February 2013, but in April 
2013, abruptly withdrew from the competitive business process. Shortly afterward, in 
May 2013, another company, NexDefense, was awarded the right to negotiate an 
exclusive commercial license. See Stmt, of Facts, Dkt. 2-2, f 22. Around that same time, 
on May 1, 2013, Southfork began marketing a software product called "Visdom" on its 
website. Id. f 44. Battelle says Visdom is a copy of Sophia, and further says that 
defendants intend to offer Visdom as an open- source product. Battelle has submitted a 
screenshot of Southfork's website, as it existed on October 10, 2013. That screenshot 
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says, relative to Visdom, that "We'll have the source code and an issue/feature tracking 
system up shortly." See Randolph Dec, Dkt. 7, f 5; Ex. A at 4. Southfork's website also 
contains the following statement: "We like hacking things and we don't want to stop." 
Id., Ex. A, at 8. 

Battelle terminated Thuen in June 2013. In this action, Battelle alleges eight 
claims against Thuen and Southfork: (1) copyright infringement; (2) trade secret 
misappropriation; (3) breach of contract; (4) tortious interference with prospective 
economic advantage; (5) unfair competition; (6) conversion; (7) breach of the implied 
covenant of good faith and fair dealing; and (8) unjust enrichment. 

ANALYSIS 

1. The Legal Standard 

The standard for a temporary restraining order is the same as for a preliminary 
injunction. See Stuhlbarg Int'l Sales Co., Inc. v. John D. Brush & Co., 240 F.3d 832, 839 
n. 7 (9th Cir . 2001). To obtain preliminary injunctive relief, the moving party must 
show: (1) a likelihood of success on the merits; (2) a likelihood of irreparable harm to 
the moving party in the absence of preliminary relief; (3) that the balance of equities tips 
in favor of the moving party; and (4) that an injunction is in the public interest. Winter v. 
Natural Res. Def. Council Inc., 555 U.S. 7, 20 (200 8). The court may apply a sliding 
scale test, under which "the elements of the preliminary injunction test are balanced, so 
that a stronger showing of one element may offset a weaker showing of another." 
Alliance for the Wild Rockies v. Cottrell, 632 F.3d 1127, 1131 (9th Cir. 2 011). A 
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restraining order is an "extraordinary remedy that may only be awarded upon a clear 
showing that the plaintiff is entitled to such relief." Winter, 555 U.S. at 22 . 

Plaintiffs in this case ask the Court issue a temporary restraining order without 
first notifying defendants. Under Rule 65(b) , a district court may issue a temporary 
restraining order without notice only if: 

(A) specific facts in an affidavit or a verified complaint clearly show 
that immediate and irreparable injury, loss, or damage will result 
to the movant before the adverse party can be heard in 
opposition; and 

(B) the movant's attorney certifies in writing any efforts made to 
give notice and the reasons why it should not be required. 

Fed. R. Civ. P. 65(b)(1) (emphasis added). 

The Court will address each of these required showings in turn. 

2. Likelihood of Success on the Merits - Copyright Infringement 

Regarding the likelihood of success on the merits - "the main bearing wall of the 
four-factor framework," Ross-Simons of Warwick, Inc. v. Baccarat, Inc., 102 F.3d 12, 16 
(1st Cir. 1996) - Battelle has established it will likely succeed on the merits of its 
copyright infringement claim. 1 To establish copyright infringement, Battelle must show 
(1) ownership of a valid copyright and (2) the unauthorized copying of constituent 
elements of the copyrighted work that are original. Feist Pub'ns, Inc. v. Rural Tel. Serv. 
Co., 499 U.S. 340, 361 (1991). 



1 Battelle also alleges six other claims. The Court will not address these claims at this point, 
given its conclusion that Battelle will likely succeed on the merits of its copyright claim. 
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A. Ownership 

Battelle relies on the fact that in September 2013, it applied for copyright 
registration to establish a presumption of copyright ownership. See App. Mem., Dkt. 2-1, 
at 4. Applying for registration, however, does not entitle Battelle to this presumption. 
Battelle needs the registration certificate. See 17 U.S.C. § 410(c); 2 Cosmetic Ideas, Inc. 
v. IAC/Interactivecorp., 606 F.3d 612, 621, n.14 (9th Cir. 2010) ("a defendant is in some 
ways aided by a plaintiffs lack of a certificate, because if a party proceeds to litigation 
without a registration certificate, it bears a greater evidentiary burden of proving the 
validity of its copyright") 

Regardless, Battelle has adequately demonstrated that it authored Sophia and that 
Sophia is copyrightable subject matter. See 17 U.S.C. § 102(a)(1) (copyright production 
subsists in original works of authorship in various categories, including literary works). 
Battelle has submitted evidence establishing that Sophia was created by a Battelle project 
team during the years 2010 to 2012. See SOF, Dkt. 2-2, % 4-6. And there is no doubt that 
that computer programs are eligible for copyright protection. See Johnson Controls, Inc. 
v. Phoenix Control Sys., 886 F.2d 1173, 1175 (9th Cir. 1989) ("Computer software is 
subject to copyright protection."), abrogated on other grounds by eBay Inc. v. 
MercExchange, L.L.C, 547 U.S. 388 (2006). Protection under the Copyright Act extends 
to both "literal" and "non-literal" components of computer software. Id. Literal 

This section provides: "In any judicial proceedings the certificate of a registration made before 
or within five years after first publication of the work shall constitute prima facie evidence of the 
validity of the copyright and of the facts stated in the certificate. The evidentiary weight to be 
accorded the certificate of a registration made thereafter shall be within the discretion of the 
court." 



MEMORANDUM DECISION & ORDER - 6 



Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 7 of 15 



components include source codes and object codes and non-literal components include 
the software's structure, organization, and user interface. Id. However, elements of 
computer programs which constitute ideas, processes, or methods of operation are not 
protected by copyright law. Apple Computer, Inc. v. Microsoft Corp., 35 F.3d 1435, 1444 
(9th Cir. 1994). Whether a particular component of a computer program is protected by a 
copyright depends on whether it qualifies as an "expression" of an idea rather than the 
idea itself. Harper & Row Publishers, Inc. v. Nation Enters., All U.S. 539, 547 (1985); 
see Johnson, 886 F.2d at 1 175. Here, based on the evidence before it, the Court 
concludes that Sophia's source code is a literal component of the computer program, and 
thus protectable. 

B. Infringement 

As for infringement, if there is no evidence of direct copying, "proof of 
infringement involves fact-based showings that the defendant had 'access' to the 
plaintiff's work and that the two works are 'substantially similar.'" Funky Films, Inc. v. 
Time Warner Entm't Co., 462 F.3d 1072, 1076 (9th Cir. 2006) (citation omitted). 

Here, Battelle has put forward adequate circumstantial evidence to permit an 
inference that defendants copied Sophia. Battelle says Thuen created Visdom in a time 
period that is impossible without copying; he described Visdom in nearly identical 
language as was used to describe Sophia; he used the same demonstration videos to 
showscase Visdom' s functionality as he did to showcase Sophia; he has admitted to 
copying parts of Sophia; and he has adopted a nearly identical name. Based on this 
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record, the Court concludes that Battelle is likely to prevail on its copyright infringement 
claim. 

3. Likelihood of Irreparable Harm 

There is no presumption of irreparable harm based upon a finding of likely success 
on the merits of a copyright infringement claim. See Flexible Lifeline Sys., Inc. v. 
Precision Lift, Inc., 654 F.3d 989 (9th Cir. 2011). Many courts have observed, however, 
that proof of irreparable harm should not be difficult to establish in a run-of-the-mill 
copyright infringement case. E.g., Apple Inc. v. Pystar Corp., 673 F. Supp. 3d 943, 948 
(N.D. Cal. 2009). 

Here, Battelle has shown that the harm from infringement will be immediate and 
irreparable. Most broadly, releasing Sophia open-source has national security 
implications. As Battelle puts it, "Defendants plan to give away the keys to Sophia ... to 
the very attackers Sophia is meant to thwart." App. at 2-1 (citing SOFf 51). 
Additionally, Battelle has demonstrated that it faces intangible losses such as loss of (1) 
goodwill with third parties and commercial partners; (2) the ability to attract and retain 
talent; and (3) the ability to pursue R&D projects in "sensitive government areas." Thus, 
the Court finds a likelihood of irreparable harm. 

4. Balance of Hardships 

An injunction may not issue unless the balance of hardships tips sharply in favor 
of the moving party. Int'l Jensen, Inc. v. Metrosound U.S.A., Inc., 4 F.3d 819, 822 (9th 
Cir.1993). Battette has demonstrated that the balance of hardships tips sharply in its 
favor. At most, defendants could claim that an injunction might harm their business. But 
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the hardship suffered by Battelle will be greater if defendants are not enjoined from 
infringing or misappropriating Battelle' s copyrighted work. Indeed,dDefendants "cannot 
complain of the harm that will befall [them] when properly forced to desist from [their 
infringing activities." Triad Systems Corp. v. Southeastern Exp. Co., 64 F.3d 1330, 1338 
(9th Cir.1995). Accordingly, the Court concludes that the balance of hardships tips 
sharply in favor of Plaintiffs. 

5. Public Interest 

In each case, a court must balance the competing claims of injury and must 
consider the effect on each party of the granting or withholding of the requested relief." 
Amoco Production Co., 480 U.S. at 542. Here, there are national security implications 
associated with an open-source release of Sophia or Visdom. Further, "it is virtually 
axiomatic that the public interest can only be served by upholding copyright protections 
and correspondingly, preventing the misappropriation of skills, creative energies, and 
resources which are invested in the protected work." Apple Computer, Inc. v. Franklin 
Computer Corp., 714 F.2d 1240, 1255 (3d Cir. 1983). 

6. Issuing the Order Without Notice 

Having determined that Battelle is entitled to a temporary restraining order, the 
Court now turns to the question of whether that order can be entered without notice to 
defendants. 

The Supreme Court has explained that the circumstances justifying the issuance of 
an ex parte temporary restraining order are extremely limited. "The stringent restrictions 
imposed ... by Rule 65 on the availability of ex parte temporary restraining orders reflect 
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the fact that our entire jurisprudence runs counter to the notion of court action taken 
before reasonable notice and an opportunity to be heard has been granted both sides of a 
dispute." Granny Goose Foods, Inc. v. Teamsters, 415 U.S. 423, 438-439 (1974) 
(internal citation omitted). In keeping with these concerns, the Ninth Circuit has stated 
that there are "very few circumstances justifying the issuance of an ex parte TRO." Reno 
Air Racing Ass 'n, Inc. v. McCord, 452 F.3d 1126, 1131 (9th Cir. 2 006). When notice 
could have been given to an adverse party, the moving party must establish that '"notice 
to the defendant would render fruitless the further prosecution of the action.'" IcL (citing 
Am. Can Co., 742 F.2d at 322). 

Here, there are two potential actions defendants might take if they get notice of 
this lawsuit and of Battelle's request for a restraining order. First, defendants say they 
intend to release Visdom as an "open-source" product "shortly." Second, Battelle asserts 
that defendants are likely to wipe the hard drives on Thuen's computer, thus destroying 
direct evidence of wrongdoing. Battelle suggests that either of these actions would render 
further prosecution of the lawsuit fruitless. 

The Court is persuaded to issue a restraining order without notice based on 
defendants' statements that they will release Visdom "shortly" as an open-source product. 
Battelle has put forth facts showing that such an action would destroy their business and 
substantial development of Sophia, because Battelle would not be able to sell a product if 
defendants give it away. See SOF f 52; Kaczor Dec. ffff 30-3 1 . The Court finds it 
significant that defendants are self-described hackers, who say, "We like hacking things 
and we don't want to stop." Id., Ex. A, at 8. Additionally, the facts show that Thuen 
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previously defied Battelle's instructions to refrain from widely releasing video 
demonstrations of Sophia on the internet. See Colson Dec. ff 18-20 (Thuen released a 
video demonstration of Sophia widely, rather than in accordance with the limitations 
Battelle imposed). 

Additionally, the Court is also convinced that defendants would destroy evidence 
(i.e., that they would wipe their hard drives) if they were given notice of this lawsuit. To 
demonstrate that the defendants would destroy evidence, Battelle "must do more than 
assert that the adverse party would dispose of evidence if given notice.'" Reno Air, 452 
F.3d at 1131 (citing First Tech. Safety Sys., Inc. v. Depinet, 11 F.3d 641, 650 (6th Cir. 
1993)). Rather, Battelle must show that the defendants have "a history of disposing of 
evidence or violating court orders or that persons similar to the adverse party have such a 
history." IcL (citing In the Matter ofVuitton et Fils S.A., 606 F.2d 1, 5 (2d Cir. 1979) ). 

Battelle asserts generally that defendants who have the technical ability to wipe 

out a hard drive will do precisely that when faced with allegations of wrongdoing. See 

App. Mem., Dkt. 2-1, at 17. To support this assertion, defendants cite to Battelle 

employee Michael Colson, who testifies as follows: 

I have 23 years of experience as an investigator for government and 
private entities and have worked many times on matters where 
employees have - without authorization - taken data from employers 
for their own purposes. In my experience it is very common for such 
individuals to simply delete the data when they are confronted with an 
investigation, rather than admit wrongdoing. This is particularly so in 
regards to those with technical skills to wipe the data in a way which 
does [not ] leave digital footprints. My investigation has revealed that 
Thuen has (or had) an unauthorized copy of executable Sophia code on 

Based on the context, it is obvious that the word "not" should be inserted here. 
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his home computer and, from my experience, there is a high risk that he 
might wipe his computers destroying evidence if he had advance 
warning. 

ColsonAff, Dkt. 2-3 \35. 

In addition, the defendants have identified themselves as hackers, as discussed 
above. A well-known characteristic of hackers is that they cover their tracks. 
Padmanabhan, Hacking for Lulz, 15 Vand. J. Ent. & Tech. L. 191, 197-98 (Fall 2012) 
(discussing how "hackers (1) log in to computers remotely, and (2) use fictitious Internet 
protocol (IP) addresses to conceal their identities"); Martin, Vicarious and Contributory 
Liability for Internet Host Providers, 27 Wis. Int'l L.J. 363, 408 (Summer 2009) 
(discussing how "hackers will likely become wiser and learn new and more effective 
ways to conceal their activities.") This makes it likely that defendant Thuen will delete 
material on the hard drive of his computer that could be relevant to this case. Battelle has 
therefore shown under Reno Air that "persons similar to" the defendant - a former 
employee who allegedly stole data and is a self-described computer hacker - have a 
history of disposing of evidence. 

The Court has struggled over the issue of allowing the copying of the hard drive. 
This is a serious invasion of privacy and is certainly not a standard remedy, as the 
discussion of the case law above demonstrates. The tipping point for the Court comes 
from evidence that the defendants - in their own words - are hackers. By labeling 
themselves this way, they have essentially announced that they have the necessary 
computer skills and intent to simultaneously release the code publicly and conceal their 
role in that act. And concealment likely involves the destruction of evidence on the hard 
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drive of Thuen's computer. For these reasons, the Court finds this is one of the very rare 
cases that justifies seizure and copying of the hard drive. 

Finally, given these rulings, the Court can find no reason to shut down the website, 
which appears to serve other purposes than the dissemination of the litigated matters. 
7. Security 

Federal Rule of Civil Procedure 65(c) provides that "The court may issue a 
preliminary injunction or a temporary restraining order only if the movant gives security 
in an amount that the court considers proper to pay the costs and damages sustained by 
any party found to have been wrongfully enjoined or restrained." The Court finds that 
security in the amount of $25,000 is sufficient under the circumstances of this case. This 
amount may be increased, if necessary, based upon an appropriately filed motion by 
defendants supporting such an increase. 

ORDER & TERMS OF THE TRO 

IT IS HEREBY ORDERED that: 

(1) Battelle's ex parte application for a temporary restraining order (Dkt. 2) is 
GRANTED in part and DENIED in part, for the reasons stated above. . 

(2) At 4:45 p.m. on this 15th day of October, 2013, the Court issues this 
Temporary Restraining Order enjoining defendants, and their agents, 
employees, attorneys or all persons acting in concert and participation with 
either of them as follows: 

a. Defendants are ordered to refrain from releasing Visdom or Sophia as 
an open- source product. 
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b. Defendants are ordered to refrain from destroying or altering any 
information on their computers (including on the hard drives) related in 
any way to Sophia or Visdom. 

c. Defendants shall immediately turn over defendant Thuen' s computer 
hard drive to a forensic expert retained by Plaintiffs. 

d. Plaintiffs shall, without examining that copy or image, immediately 
deliver it to the Court where it will be held pending further litigation in 
this case 

e. Plaintiffs shall thereafter immediately return the hard driver to Thuen in 
the same condition it was in when obtained. 

f. Defendants shall take reasonable steps to preserve any and all records or 
documents, as defined in Federal Rule of Civil Procedure 34(a)(1)(A), 
including information contained on their computer hard drives. 

(3) Battelle shall hand-serve defendants with copies of (1) the complaint, (2) the ex 
parte application for a temporary restraining order, including all supporting 
documents and declarations; and (3) a copy of order, within 24 hours of the 
issuance of this order. 

(4) Battelle shall post security in the amount of $25,000 no later than 48 hours 
after this order issues. 

(5) This Temporary Restraining Order will EXPIRE at 4:45p.m. on October 29, 
2013. 
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(6) The Court will expedite the hearing on Battelle's request for a preliminary 
injunction. The Court will refer this request to Honorable Robert J. Bryan, 
Senior United States District Judge for the Western District of Washington, 
sitting by special designation. The parties are ordered to appear for the 
preliminary-injunction hearing before Judge Bryan on Thursday, October 17, 
2013 at 9:30 a.m., in Courtroom 1 of the Federal Courthouse in Boise, Idaho, 
which located at 550 West Fort Street. The Court is scheduling this hearing 
on an expedited basis because of the extraordinary relief requested and granted. 
At the defendant's request, the matter will be delayed to provide the defendant 
with an opportunity to obtain counsel and prepare for the hearing. 




United States District Court 
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